Do you want to view the content that was delivered securely?

[jmt356]

I recently had an issue with some adware being added to my computer from the program Babylon. Around that same time, I noticed an unusual number of Security Warnings from IE when visiting pages asking “Do you only want to view the webpage content that was delivered securely?” Some of these seemed legitimate because the web pages that I was viewing had “https” in front of them. However, what is unusual is some of these web addresses, in my view, should not be preceded by “https.” For example, my Google search results are now preceded by “https.”

Does this have anything to do with the adware? Could it be related to recently upgrading to Google+?

Any guidance would be much appreciated.

[HansV]

If you're signed in to your Google account, you're automatically redirected to the https version of Google, so that's not suspect.

(And increasingly, even if you're not signed in, you'll get the https version)

[jmt356]

I just logged out of Google and the securely-delivered content requests have stopped for the time being.

I will post back if an abnormally high number of such requests continues.

Hans, I give you credit for knowing so much about and keeping up with all this developing technology. To my knowledge, you're unparalleled.

[HansV]

See Making search more secure for some background info about the use of https by Google.

[JoeP]

You see those requests because the page you visited has mixed secure and non-secure content delivery. When you visit a site using HTTPS your browser expects all content to be delivered securely. When it is not delivered securely you see the message.

Joe

[jmt356]

I am getting these requests very frequently, perhaps for half of the web sites I visit. Is there a way to have IE remember my answer so that it not continue to ask me at each new page?

[HansV]

I don't think you can make Internet Explorer remember your choice, but you can suppress the warning:
- Select Tools | Internet Options...
- Activate the Security tab.
- Select Internet.
- Click Custom level...

x1245.png

- Scroll down to the Miscellaneous section and on until you see "Display mixed content".
- Select "Enable" instead of "Prompt" for "Display mixed content".

x1244.png

- Click OK twice.

[jmt356]

If I suppress the warning, will IE only display the content that was delivered securely?

If I am on an https site, why does IE ask me each time I click to a next page whether I want to display only the content that was delivered securely? Is this normal? It's extremely distracting on sites where I have to go through several steps to check out. At each step I have to keep on answering the question.

Also, I was on Youtube today and IE asked whether i wanted to display only content that was delivered securely. I looked at the address and it was indeed an https address. I was not logged in. Why would Youtube have secure web pages? I thought security applied when users had logged into a site or were sending sensitive data, not just viewing web page content.

[HansV]

If I suppress the warning, will IE only display the content that was delivered securely?

If you set "Display mixed content" to Enable, you'll see both https and http content on the same page.
If you set it to "Disable", you'll see only https content. Boxes that contain http content will show an error message that Internet Explorer was not able to display their content.

If I am on an https site, why does IE ask me each time I click to a next page whether I want to display only the content that was delivered securely? Is this normal? It's extremely distracting on sites where I have to go through several steps to check out. At each step I have to keep on answering the question.

If you have "Display mixed content" set to Prompt, this is normal behavior. It is a security measure that applies to each page individually, not to a web site as a whole.

Also, I was on Youtube today and IE asked whether i wanted to display only content that was delivered securely. I looked at the address and it was indeed an https address. I was not logged in. Why would Youtube have secure web pages? I thought security applied when users had logged into a site or were sending sensitive data, not just viewing web page content.

That may have to do with the way you navigated to YouTube.
And web site builders can decide to use https even if users don't have to log in to view their web site. It's not something that you as a visitor can decide.

[jmt356]

Is it unsafe to display both secure and nonsecure content?

[HansV]

It does pose a certain risk - if the http part of the page is infected, it could harm your computer while you feel secure since you're viewing a https page.
It's a tradeoff between convenience and security - you'll have to decide for yourself which is more important.
You could enable mixed content for the Trusted Sites zone and leave it set to prompt for the Internet zone. If you know for sure that a site is OK, you can add both the https site and the http site to your Trusted Sites.

See Internet Explorer 8 Mixed Content Handling for some background; it's similar for Internet Explorer 9.

[StuartR]

Is it unsafe to display both secure and nonsecure content?

Yes, it is unsafe.

When you connect to an https: site and your web browser shows that you have a secure connection, you will feel confident that you can enter things like credit card details and passwords. If the web site is also presenting you with insecure things you have no idea which is safe and which is not.

You will NEVER see this message from a site that has been designed by someone who understands security. It is usually caused by the web site displaying 3rd party content such as adverts, but then they have no control over what the 3rd party might be displaying.

[jmt356]

To display only content that was delivered securely, I should, following Hans' above instructions, click "Disable" under "Display mixed content"?

Thank you

[HansV]

Yes, indeed.